Re: [w3c/gamepad] Background gamepads (#53)

We definitely want to spec [an event-based API](https://github.com/w3c/gamepad/issues/4) at some point, it just needs someone to spend the time on it.

I don't believe it's mentioned in the spec, but the implementation in Firefox intentionally does not provide updated data to non-visible web content, to minimize the risk of information leakage. It's probably fairly minimal right now, but I can imagine a scenario where we add more complex controller data to the API and it becomes a serious issue. For example, [a paper published several years ago](http://www.cc.gatech.edu/fac/traynor/papers/traynor-ccs11.pdf) showed it was possible to use the accelerometer APIs exposed by a phone browser sitting on the same surface as a keyboard to recover keystrokes! If we expose accelerometer data from gamepads then we're vulnerable to the same attack.

Your proposed use case is definitely interesting, I'm intrigued by multi-screen gaming myself, but I'm not sure that making that example work is compelling enough to go down the road of potential information leakage. Just as a counterpoint, if the player is looking up stats in another tab, wouldn't they be using their hands to drive the laptop keyboard and not be simultaneously working the gamepad? That feels sort of contrived.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/gamepad/issues/53#issuecomment-270132141